Skip to content
Permalink
Browse files Browse the repository at this point in the history
Mitigate against reflected XSS attacks
Mitigate against reflected XSS attacks in production by returning
the custom 404 response object instead of express' default 404
response

This was discovered using the Burp pen test tool and successfully tested
by passing an arbitrary url parameter GET /images/?41b68(a)184a9=1
  • Loading branch information
ssbrewster committed Apr 13, 2016
1 parent 8078a58 commit c17092f
Showing 1 changed file with 11 additions and 0 deletions.
11 changes: 11 additions & 0 deletions app/templates/src/server/_app.js
Expand Up @@ -30,6 +30,17 @@ switch (environment) {
app.use('/app/*', function(req, res, next) {
four0four.send404(req, res);
});
// Invalid calls to assets should return the custom error object to mitigate
// against XSS reflected attacks
app.use('/js/*', function(req, res, next) {
four0four.send404(req, res);
});
app.use('/images/*', function(req, res, next) {
four0four.send404(req, res);
});
app.use('/styles/*', function(req, res, next) {
four0four.send404(req, res);
});
// Any deep link calls should return index.html
app.use('/*', express.static('./build/index.html'));
break;
Expand Down

0 comments on commit c17092f

Please sign in to comment.